Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-27442 Details

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA: CISA-ADPCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes [email protected]Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes [email protected]Release Notes

Weakness Enumeration

CWE-IDCWE NameSource
CWE-755Improper Handling of Exceptional Conditions[email protected]
CWE-269Improper Privilege ManagementCISA-ADP

Affected Products

ProductVersions
zimbra collaboration
>= 10.0.0, < 10.0.7
9.0.0 -
9.0.0 p0
9.0.0 p1
9.0.0 p10

CPE

  • cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-27442
NVD Published Date:
Aug 12, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-27442 Details - Not Deferred